AWS Certified SysOps Administrator Associate SOA-C02 (SOA-C02) — Questions 301–375

Placing a CloudFront distribution in front of the S3 bucket caches website objects at edge locations worldwide, so the vast majority of user requests are served from edge caches, not by direct S3 GETs. This dramatically reduces the number of S3 requests billed on a per-request basis, and data transfer from S3 to CloudFront is not charged, lowering egress costs. Additionally, you can restrict direct S3 access with an origin access control and use caching policies to further optimize performance and cost.

The VPC CIDR block 10.0.0.0/16 and an on-premises CIDR that also uses part of the 10.0.0.0/16 range overlap. When you establish a VPN connection or AWS Direct Connect between the VPC and the on-premises network, overlapping CIDRs create ambiguous routing: the VPC route table cannot determine whether traffic for those IPs should go to the local network or the on-premises network, so traffic may be dropped or misrouted. AWS does not allow overlapping CIDRs for VPC peering or for VPN/Direct Connect connections, so you must redesign the IP addressing to avoid overlap.

Patch Manager integrates with the SSM Agent to apply operating system patches and automatically generates compliance reports by default when used with Patch Manager scan operations. These reports classify instances as compliant or non-compliant, list missing patches, and support filtering by severity and patch baseline, exactly matching the need to scan and generate a compliance report. As a native Systems Manager capability, it provides the most direct and correct mechanism for assessing patch compliance across EC2 instances.

The upload is denied because CodeDeploy's S3 upload does not include the 'x-amz-acl' header set to 'bucket-owner-full-control'. The bucket policy's condition explicitly requires this ACL value for any PutObject request, and because the header is absent or set differently, S3 evaluates the condition as false and returns AccessDenied. This is the exact mismatch the policy is designed to catch, making the fix to add --acl bucket-owner-full-control to the upload command.

CloudFront is a global content delivery network that caches static content at edge locations worldwide, providing low latency and high transfer speeds to users by serving objects from the nearest edge. It integrates natively with S3 origins, supports HTTP/HTTPS, and automatically handles both static and dynamic content with customizable cache behavior. This directly meets the requirement for low latency access to static content.

Adding more EC2 instances to the target group horizontally scales web application capacity, allowing the ALB to distribute incoming requests across more compute resources. When latency is caused by CPU saturation, connection exhaustion, or thread-pool limits, this directly reduces per-instance load and therefore reduces queuing delay. It is the correct action because it addresses the root cause of latency under sustained traffic.

A CloudWatch metric alarm continuously evaluates the CPUUtilization metric against a defined threshold, such as 80% for five consecutive evaluation periods. When the alarm enters the ALARM state, it automatically publishes a message to an Amazon SNS topic, and that topic's email-subscribed endpoints receive a notification without any additional infrastructure. This is the standard, fully managed pattern for EC2 metric alerting; SNS handles message delivery, retries, and fan-out to multiple endpoints (email, SMS, etc.) with no servers to manage.

Attaching an IAM role to the EC2 instance via an instance profile is the AWS-recommended approach because it provides the instance with temporary, rotated credentials automatically. The instance retrieves these credentials from the instance metadata service (IMDSv2) after assuming the role, and the AWS SDK on the instance automatically uses them to sign S3 API requests without any hard-coded keys. This follows least privilege and eliminates the operational burden of key management on the instance.

The operating system firewall runs inside the instance and is completely independent of AWS's virtual firewalls. Even if the security group and network ACL both allow the traffic, iptables/nftables, UFW, or Windows Defender Firewall can silently drop the packets when they arrive at the instance's network stack. To confirm, check the OS firewall rules, examine system logs, or temporarily disable the firewall to see if connectivity is restored.

Cross-region automated backups for RDS, when configured with a backup window, copy backups to a second region automatically, meeting the 1-hour RPO by enabling point-in-time recovery to within 5 minutes of the last transaction. Deploying an identical infrastructure stack in the second region using AWS CloudFormation StackSets ensures that compute, networking, and application resources are pre-provisioned and consistently configured, eliminating manual deployment delays. Amazon Route53 DNS failover with health checks continuously monitors the primary region and automatically routes traffic to the secondary region when the primary fails, providing the automated failover needed to meet the 2-hour RTO.

When an EC2 instance is stopped, the hypervisor shuts down the guest OS and the instance's metadata and metric collection process no longer runs, so CloudWatch stops receiving any instance-specific metrics such as CPUUtilization. For a terminated instance, the same is true and the metrics are permanently gone because there is no instance to emit them. The stop action does not delete the EBS volume, but it does stop all CPU-based metric publication; therefore checking the instance state is a direct and correct explanation for an empty output.

Amazon CloudWatch Events (now part of Amazon EventBridge) is the correct service because it can create rules that match real-time AWS API calls, such as those recorded by CloudTrail, and route them to targets like SNS topics for notification. For example, a rule can filter for a specific event source and event name, then invoke an SNS topic to alert administrators, providing the event-driven notification capability the company needs.

This is the correct procedure for sharing an encrypted AMI across accounts. First, you must grant launch permissions on the AMI to the target account, which allows that account to see and launch instances from the AMI. Second, because the EBS snapshots backing the AMI are encrypted with a customer-managed KMS key, you must add the target account (or the IAM role/principal that will launch the instance) as a principal in the KMS key policy with kms:Decrypt permission. Both actions are required; without the KMS permission, instance launch will fail with an error.

Multi-AZ deployments use synchronous replication between the primary and the standby in a different Availability Zone. Every write transaction must be committed on the primary and then acknowledged by the standby before the primary returns success to the application. This adds at least one full network round-trip across AZs per write, which increases commit latency and write response times compared to a single-AZ deployment.

AWS Lambda is the correct service because it can run custom remediation code in response to an EventBridge rule that detects a CloudTrail StopLogging API call. The Lambda function uses the AWS SDK to call StartLogging or UpdateTrail, automatically re-enabling the trail without manual intervention and requiring no servers to manage.

Rotating access keys regularly limits the exposure window of compromised credentials. If a key or secret is leaked through a repository, log, or third-party integration, rotation invalidates the stolen key and forces the attacker to re-authenticate. AWS recommends rotation every 90 days or less, and you can create up to two access keys per user to enable seamless rotation without downtime.

An EventBridge rule can consume CloudTrail management events as they are delivered to the default event bus, and a rule with an event pattern matching eventSource: 's3.amazonaws.com' and eventName: 'PutBucketPolicy' will trigger immediately when that API call occurs. This provides a direct, real-time, and filterable mechanism to detect bucket policy changes without needing an intermediate metric or aggregate. It is the standard pattern for reacting to API activity.

When a user accesses a CloudWatch console dashboard, the console calls the CloudWatch GetDashboard API to retrieve the dashboard's JSON definition and metric widget configuration. If the IAM policy attached to that user denies or omits the cloudwatch:GetDashboard action, the API returns AccessDenied and the dashboard fails to load even if the user can see other CloudWatch data. Because GetDashboard is a read operation scoped to the dashboard ARN, you must explicitly grant it in the user's identity-based policy, along with permissions for any metrics the widgets query. This is the first thing to verify when the dashboard renders blank or inaccessible.

DatabaseConnections is a CloudWatch metric that directly reports the number of client network connections currently established to the RDS instance. This metric can be compared against the max_connections parameter, and when it approaches that ceiling, new connection requests fail with a 'Too many connections' error. Therefore, DatabaseConnections is the appropriate metric to monitor and alarm on to diagnose connection-limit issues.

AWS Storage Gateway (File Gateway) is a managed hybrid cloud service that presents an SMB/NFS file share to on-premises servers while storing the underlying data as Amazon S3 objects. It automatically handles encryption in transit and at rest, local caching for frequently accessed files, and asynchronous uploads with resumable transfer, making it a turnkey backup solution without custom scripts or infrastructure management.

AWS Config is the correct service because it includes the managed rule iam-user-mfa-enabled, which continuously evaluates whether each IAM user has an MFA device registered. The rule is part of the CIS AWS Foundations Benchmark and can be configured to run periodically or on configuration changes, returning a noncompliant result for any user missing MFA. This makes AWS Config the appropriate service for automated compliance monitoring and reporting, not just logging or ad-hoc checks.

An Auto Scaling group is capacity management that spans multiple Availability Zones, launching and terminating instances to maintain a desired count and to replace unhealthy ones automatically. By distributing instances across AZs, it ensures that the application tier remains available even if an entire AZ becomes unavailable, providing fault tolerance and elasticity.

Resizing the EC2 instance to a larger type, such as changing from t3.medium to t3.large, is a vertical scaling operation that allocates more compute resources to the same virtual machine. A larger instance type typically provides more vCPUs, higher baseline CPU performance, and more memory, directly increasing the capacity to process instructions without queueing, thereby reducing CPU utilization. For t3 families, the larger size also raises the CPU credit earning rate and baseline (e.g., from 20% to 30% for medium to large), so even modest workloads experience fewer credit exhaustions and less throttling.

The CloudWatch agent is required to collect in-guest operating system metrics such as memory utilization, disk I/O counters, and process-level resource usage. It runs inside the EC2 instance, reads from the OS, and publishes these as custom metrics to CloudWatch, enabling centralized monitoring via dashboards and alarms. Unlike basic or detailed monitoring, which only capture hypervisor-visible measurements, the agent has direct access to OS performance counters.

The virtual private gateway (VGW) or transit gateway (TGW) serves as the AWS-side endpoint for a site-to-site VPN connection. It must be attached to a VPC (or a transit gateway for centralized connectivity) and terminates the IPsec tunnels from the on-premises network. Without this component, there is no target for the VPN traffic on AWS, making it a mandatory piece.

Increasing the unhealthy threshold to 5 requires five consecutive failed health checks before an instance is declared unhealthy, rather than immediately reacting to a single failure. This adds tolerance for short-lived network glitches or transient resource bottlenecks, filtering out spurious failures and significantly reducing flapping while still allowing the load balancer to eventually remove a truly unhealthy instance.

AWS CloudFormation StackSets is the correct service because it extends the capability of CloudFormation to deploy stacks across multiple AWS accounts and multiple Regions from a single administrator account. You define a CloudFormation template once, and StackSets creates and manages stack instances in target accounts/Regions, propagating updates and handling automatic rollback if any deployment fails. This provides the centralized, repeatable, and cross-account infrastructure deployment exactly as the sysops administrator needs.

Changing the statistic to p95 means the alarm triggers when the 95th percentile latency exceeds 5 seconds, effectively ignoring the slowest 5% of requests. This reflects the experience of the majority of users, because rare outliers like a single bad request won't cause false alarms. Keeping the threshold at 5 seconds ensures the alarm still detects genuine degradation affecting the typical request. p95 is a robust metric for latency monitoring because it filters out transient spikes while staying responsive to systemic issues.

AWS Trusted Advisor continuously inspects your AWS environment and delivers real-time recommendations across five categories: cost optimization, performance, security, fault tolerance, and service limits. For cost optimization, it identifies underutilized Amazon EC2 instances, idle RDS databases, and untapped Reserved Instance or Savings Plan opportunities, making it a core tool for right-sizing and eliminating waste.

AWS CloudFormation StackSets extends AWS CloudFormation to deploy and manage stacks across multiple accounts and regions from a single administrator account, which exactly matches the requirement to automate infrastructure deployment across accounts. StackSets use a stack set to define a template and a list of target accounts, then create, update, or delete stacks in each account and region in a single operation, with automatic rollback if any stack fails. You can also integrate StackSets with AWS Organizations to automatically deploy to all accounts in an organization, and use a delegated administrator for centralized management. This makes StackSets the correct choice for the stated automation scenario.

aws:MultiFactorAuthPresent is a Boolean global condition key that is populated in the request context after authentication. It evaluates to true only when the principal authenticated with a valid MFA device, such as a hardware token or virtual MFA application. In an IAM policy, you can write a Deny statement using this key with a BoolIfExists condition to explicitly block requests that did not use MFA, which directly satisfies the security requirement. Because it reflects the MFA authentication state itself, it is the correct condition key to enforce this policy.

VPC peering establishes a one-to-one network relationship between two VPCs using private IPv4 addresses over AWS's backbone. It requires no virtual appliance, gateway, or physical contract, making it the simplest and most cost-efficient method for a two-VPC scenario in the same region. Since the CIDRs are non-overlapping, route tables can be updated to exchange traffic directly with minimal latency and high throughput.

Because the alarm is configured with metric CPUUtilization, statistic Average, Period 5 minutes, and EvaluationPeriods 1, the metric value is the mean CPU utilization over the most recent 5-minute interval. When that average exceeds the 80% threshold for a single period, the alarm immediately enters ALARM state. This precisely matches the exhibit's configuration, so the alarm triggered exactly for this reason.

AWS Config is the correct service because it provides managed rules such as s3-bucket-default-encryption-enabled and s3-bucket-encryption-enabled that continuously evaluate S3 bucket configurations. When a bucket is created or altered without default encryption, AWS Config records it as non-compliant and can trigger SNS notifications or Amazon EventBridge rules to alert security teams. It also maintains a complete configuration history and compliance timeline, making it ideal for automatically detecting and auditing encryption settings across all S3 buckets.

Configuring an S3 Lifecycle policy to transition objects from S3 Standard to S3 Standard-IA after 30 days and then to S3 Glacier Deep Archive after 90 days is the most effective approach because it automates cost optimization while preserving data availability based on predictable access patterns. Standard-IA reduces storage costs for infrequently accessed data after the initial month, and Glacier Deep Archive provides the lowest storage cost for long-term archival after 90 days. Lifecycle rules handle the transitions in batches, avoid manual effort, and ensure compliance with storage-class minimums. This balances immediate accessibility with long-term cost savings for the 1 PB dataset.

Route 53 Resolver outbound endpoints, when paired with forwarding rules, are the correct mechanism for conditional DNS forwarding from a VPC to on-premises. The outbound endpoint creates ENIs in your VPC that Route 53 Resolver uses to send queries to target DNS servers you specify, while forwarding rules associate a domain name such as corp.example.com with those on-premises DNS server IPs. Any query from a resource in the VPC for that domain is forwarded based on the rule; queries for other domains continue to use the default VPC resolver, enabling seamless hybrid DNS resolution.

AWS Trusted Advisor is the correct choice because it directly provides cost optimization recommendations, such as identifying idle resources, underutilized Amazon EC2 instances, unattached Elastic IP addresses, and Amazon EBS volumes with low I/O activity. For a company deploying with CloudFormation, Trusted Advisor can highlight which provisioned resources are over- or under-provisioned, enabling right-sizing or termination to reduce spend. Its cost optimization checks also suggest purchasing Reserved Instances or Savings Plans based on usage patterns, making it the only listed service that explicitly targets cost reduction.

In Elastic Beanstalk, the EC2 instances that form your environment rely on the instance profile (an IAM role) to retrieve the application source bundle from Amazon S3 during deployment. If that instance profile is missing a policy permitting s3:GetObject on the bucket or object containing the application version, the instances receive an Access Denied error and the deployment fails. This is the classic root cause because many assume the service role handles this, but the service role is only used by the Elastic Beanstalk service itself.

Using CloudFormation to manage the S3 bucket and its bucket policy is the recommended infrastructure-as-code practice. When the stack is updated as part of the CodePipeline execution, any policy changes are applied deterministically, with drift detection and automatic rollback on failure. This ensures the CloudFront origin access configuration and bucket policy remain in sync across every deployment, eliminating manual intervention and reducing the risk of misconfiguration.

Performance Insights is the correct choice because it correlates database load with individual SQL statements. The top SQL queries view breaks down DB Load by query, showing which SQL text is consuming CPU and waiting on resources in near real time. This lets you pinpoint the specific query (or queries) causing the CPU bottleneck, along with its execution plan and host/user details, rather than just seeing a metric spike.

By default, a CloudTrail trail logs events only in the region where it was created unless you explicitly configure it to log all regions. When a trail is single-region, any API activity occurring in other AWS regions is not captured, while events in the trail's home region are still logged normally. This matches the scenario of missing events if those events occurred outside the trail's configured region.

A VPC Gateway Endpoint attaches to route tables and provides private connectivity to S3 using prefix lists, so traffic never traverses a NAT gateway or internet gateway. This satisfies the requirement that private-subnet instances reach S3 without either egress device.

AWS Backup lifecycle policies let you specify a retention period, such as 7 years (2555 days), after which recovery points are automatically expired and deleted. This automated, policy-driven approach ensures backups are retained for the required duration without manual intervention and provides an auditable record of compliance. Setting the retention period in the backup plan is the definitive way to satisfy a 7-year retention mandate.

A single AWS Direct Connect connection supports multiple private virtual interfaces, each configured with a unique 802.1Q VLAN tag on the customer router and a distinct BGP session. Each private VIF is associated with a separate Virtual Private Gateway or through a Direct Connect Gateway, enabling isolated, dedicated connectivity to a specific VPC over the same physical fiber. This design maximizes bandwidth utilization by sharing the underlying port while maintaining Layer 2 isolation between VPCs, and it is the standard, cost-effective way to connect one on-premises network to multiple VPCs.

An Application Load Balancer is a supported custom origin for CloudFront, which is why the statement is correct. You point the origin domain name to the ALB's DNS name (for example, my-alb-1234567890.us-east-1.elb.amazonaws.com) and configure the protocol (HTTP or HTTPS) that CloudFront should use when forwarding requests. Because the ALB is a public endpoint, you must ensure its security group allows inbound traffic from CloudFront's IP ranges, and it can be used to serve dynamic or mixed content behind CloudFront.

S3 Cross-Region Replication (CRR) asynchronously copies every uploaded object to a destination bucket in a different AWS Region, providing the geographic redundancy required for disaster recovery. CRR requires versioning to be enabled on both the source and destination buckets, and it can replicate to a different storage class. This ensures critical data remains available even if the entire source Region becomes unavailable.

The request is denied because of the explicit Deny statement. IAM policy evaluation gives Deny statements absolute priority: if any applicable Deny exists, the request is automatically denied, even if an Allow statement also matches. In this exhibit, the Deny statement is unconditional and explicitly targets the S3 path, so it vetoes the request regardless of any IP-based Allow condition.

Detaching the instance from the Auto Scaling group prevents the ASG from automatically replacing or terminating it due to health checks, while applying a security group that denies all traffic cuts off network communications to and from the instance. This stops command-and-control channels, data exfiltration, and lateral movement, and preserves the instance's disk and memory for forensics. This is the correct first step in EC2 incident response.

S3 Versioning is a correct step because it preserves every version of an object, including all overwrites and the original copy before a delete operation. When a DELETE is issued, versioning inserts a delete marker rather than physically removing the object, allowing straightforward rollback to a prior state. This directly mitigates permanent data loss caused by accidental user actions or application bugs, thus strengthening durability.

Replica lag occurs when the replica cannot keep up with the rate of changes from the primary. Increasing the replica's instance size gives it more resources to apply WAL data faster, reducing lag. This directly addresses the performance bottleneck.

Modifying the allocated storage on an existing Multi-AZ RDS for MySQL instance is the correct approach because RDS supports in-place storage scaling without a full rebuild. For Multi-AZ deployments, Amazon performs the modification with a brief, automatic failover to the standby, resulting in typically less than a minute of downtime rather than hours-long migrations. The KEY keyword 'production' and 'minimal downtime' align with RDS's native ModifyDBInstance operation, which can also enable Storage Auto Scaling as a proactive measure, but the immediate fix is to increase the allocated storage to accommodate the data growth.

Distributing EC2 instances across at least two Availability Zones ensures that the application layer remains operational even if an entire AZ experiences an outage, because each AZ is an isolated failure domain with independent power, networking, and cooling. This architecture allows a load balancer or DNS failover to route traffic to healthy instances in the remaining AZs, making it the foundational step for a resilient disaster recovery design that protects compute resources.

Correct: you create a CloudWatch alarm on DatabaseConnections with a threshold (e.g., high connections for 5 minutes); when it enters ALARM, it sends a notification to an SNS topic that triggers a Lambda function, or uses an alarm action to invoke Lambda directly. The Lambda function calls the RDS ModifyDBInstance API with the desired DBInstanceClass and the DBInstanceIdentifier, and RDS performs the scaling. This is an event-driven, low-latency pattern that requires no polling and is a supported, commonly used approach for automated RDS instance-class scaling.

An EC2 automatic recovery action driven by a CloudWatch alarm monitors the system status check and, if a failure is detected, restarts the instance on new underlying hardware while preserving its instance ID, private IP, Elastic IP addresses, and all attached EBS volumes. Because the root device is EBS-backed and the attached volumes remain intact, there is no data loss, achieving a zero recovery point objective (RPO), and the restart typically completes in only a few minutes, well within a 30-minute RTO. This makes it the only option that inherently satisfies both recovery targets without requiring separate backup or replication infrastructure.

A CloudWatch alarm on CPU utilization can trigger a Lambda function that calls ModifyDBInstance to change the DB instance class to a larger size, such as moving from db.m5.large to db.m5.xlarge. This is an event-driven automation that scales compute reactively based on the actual load. Keep in mind that changing the instance class requires a reboot, but with Multi-AZ or maintenance window settings you can minimize downtime; this pattern directly resolves the CPU bottleneck.

AWS CloudFormation is the correct service for infrastructure provisioning because it implements infrastructure as code through declarative JSON or YAML templates. It orchestrates the creation, update, and deletion of entire stacks, managing dependencies, rollbacks, and change sets so resources are provisioned in a predictable and repeatable way. This makes it the core engine for automating the deployment of AWS environments.

Cross-account S3 access requires both a resource-based policy (bucket policy) that grants Account B access, and identity-based policies in Account B that allow the action. The bucket policy's Principal field specifies Account B's account root ARN or specific role ARNs. When both sides allow, the call succeeds without any role chaining or credential sharing.

This solution uses CloudTrail as the authoritative audit source, delivering root user API activities to a CloudWatch Logs log group. A metric filter with a pattern for root user events (such as userIdentity.type equal to Root) generates a numeric metric from those log entries, and a CloudWatch alarm on that metric triggers an SNS notification when the threshold is breached. This pipeline provides real-time, event-driven alerts for the required root user monitoring.

Enabling VPC Flow Logs for the subnet captures detailed IP traffic metadata for every elastic network interface attached to your EC2 instances, including source/destination IPs, ports, protocol, packet and byte counts, and whether the action was ACCEPT or REJECT. This telemetry is published to CloudWatch Logs or an S3 bucket, letting you analyze traffic patterns to pinpoint intermittent glitches such as unexpected spikes, asymmetric routing, or security-group blockages. Because the question points to network-related performance issues, flow logs provide the exact diagnostic data needed.

The CodeDeploy agent is the on-instance software component responsible for all communication with the CodeDeploy service. It polls the CodeDeploy endpoint for queued deployments, downloads the application revision, runs the lifecycle event scripts defined in the AppSpec file, and reports success or failure back to the service. Without the agent installed on an instance, the instance cannot receive any deployment commands, and CodeDeploy will report that no instances are connected or that the deployment is stuck with zero healthy instances. This is the exact, direct reason why the deployment is not progressing; installing and starting the agent on each target instance would resolve the issue.

AWS CloudTrail records API activity in your account and delivers management events to Amazon EventBridge in near real time, typically within seconds. EventBridge rules can filter these events using event patterns—for example, matching on event source, event name, or user identity—and route them to targets like SNS to send notifications, or Lambda to trigger custom actions. This combination is purpose-built for real-time API call monitoring and notification, making it the correct choice. The event payload includes the identity of the caller, the request parameters, and the response, giving full visibility into the API call.

Attaching the target group to the Auto Scaling group is the AWS-recommended managed integration: when the Auto Scaling group launches new instances, it automatically registers them with the attached target group, and when instances are terminated, it deregisters them. This ensures that CodeDeploy, which can deploy to instances registered with a target group, has a current and accurate list of deployment targets without custom scripting. This approach is the correct answer because it leverages native AWS orchestration to keep target group membership synchronized with the Auto Scaling group's instance lifecycle.

When an Auto Scaling group uses a launch template, it references a specific version of that template through the Version property. Updating the AMI inside the CloudFormation stack creates a new version of the launch template, but the ASG may still point to the old default version or a fixed version number. If the Version is not set to $Latest or explicitly updated to the new version number, any new instances launched by the ASG will continue to use the old template, and therefore the old AMI. This is exactly the behavior described, so this is the correct root cause.

VPC Flow Logs capture IP traffic metadata at the elastic network interface level, including source/destination IP addresses, ports, protocol, and action (accept or reject) for each packet. This data is published to Amazon CloudWatch Logs or Amazon S3, enabling administrators to monitor traffic patterns, troubleshoot connectivity issues, and analyze security groups or network ACL behavior. Unlike logging services, VPC Flow Logs are the native AWS mechanism specifically for network traffic monitoring.

S3 Standard-IA is purpose-built for data that is accessed infrequently but requires millisecond access when requested. It offers the same durability and high availability as S3 Standard at a lower storage price, with a per-GB retrieval fee and a 30-day minimum storage duration. This directly matches the company's usage pattern of infrequently accessed data without sacrificing immediate availability.

Dynamic scaling policies using a target tracking policy based on CPU utilization are correct because they automatically adjust the Auto Scaling group's desired capacity in real time to maintain CPU at a defined target (e.g., 60%). This prevents both over-provisioning and under-provisioning, enabling the web application to handle variable traffic without manual intervention, and it optimizes cost by only adding instances when demand actually increases.

This is the standard, native approach: CloudWatch continuously ingests the CPUUtilization metric from EC2, and an alarm evaluates that metric against a threshold over a specified number of consecutive evaluation periods. By setting the threshold to 80% and the evaluation periods to 5, you get an alert only after the CPU stays above 80% for five straight minutes, matching the requirement exactly. This requires no additional code, no separate services, and integrates directly with SNS for notification, making it the most efficient and reliable solution.

AWS Cost Explorer is a cost management service with an intuitive interface that lets you explore and visualize your AWS costs over time. You can filter and group by service, linked account, region, instance type, and cost-allocation tags, which enables you to produce custom views for cost allocation and chargebacks. Additionally, it supports forecasting and report sharing, making it the appropriate tool for detailed cost analysis and allocation.

Increasing the maximum price for the Spot request in the launch template directly addresses the root cause: the Auto Scaling group cannot launch Spot Instances when the current Spot market price exceeds the bid price in the template. By raising the maximum price to at most the On-Demand price, you allow the Spot request to succeed, and you still only pay the current Spot market price, not the maximum. This is the recommended fix because it preserves the cost savings of Spot while maintaining capacity.

AWS CloudTrail records every IAM API call as a management event, capturing who changed which resource, when, and from where. It supplies the authoritative change history that audit tooling and log analysis consume to reconstruct all IAM modifications across the account.

Configure Scheduled Scaling to add instances before the spike and remove after. This uses Amazon EC2 Auto Scaling time-based policies to proactively adjust the desired capacity, so instances are fully registered and warmed up when the traffic surge hits. Unlike reactive dynamic scaling, scheduled scaling eliminates the lag that can cause latency or throttling during flash traffic, and then scales back down automatically after the spike to avoid paying for unused resources.

Taking a snapshot immediately after freezing the filesystem ensures the on-disk state is a stable, point-in-time representation. The freeze command flushes all dirty buffers and suspends new write operations, so the snapshot includes every block in a coherent relationship with the filesystem journal. This produces a crash-consistent backup without any interruption to the instance or application, making it the recommended backup method.

Access logs capture every ALB request including 502s. Each log entry contains the target_ip:target_port field identifying which instance handled (or failed to handle) the request, and request_processing_time and target_processing_time values for performance analysis. This data is available without any changes to instance-side software.

Network ACLs are stateless and operate at the subnet boundary. To allow an EC2 instance in the public subnet to reach a database in the private subnet, the private subnet's NACL must have an inbound rule permitting traffic from the public subnet's CIDR on the database's port. Because NACLs are stateless, you also need a corresponding outbound rule on the private subnet NACL to allow the return traffic back to the EC2 instance, and reciprocal inbound/outbound rules on the public subnet NACL if it has restrictive rules.